109 matches found
CVE-2026-102601
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...
CVE-2026-102601
The Flysystem PHP file storage library is vulnerable in versions prior to 3.35.3 due to a flaw in the WhitespacePathNormalizer component. The root cause is that preg_match with the u modifier treats false (returned during malformed UTF-8 input) as falsy, allowing paths containing control characte...
CVE-2026-102601: Improper Neutralization of Escape, Meta, or Control Sequences
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...
PT-2026-102644
Name of the Vulnerable Software and Affected Versions Flysystem versions prior to 3.35.3 Description In the WhitespacePathNormalizer class within src/WhitespacePathNormalizer.php, the normalizePath function uses preg match with the u modifier to detect control characters. When a path contains...
EUVD-2026-69706
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path...
CVE-2026-84374 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...
CVE-2026-84374 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...
PT-2026-84522
Name of the Vulnerable Software and Affected Versions Laravel Excel versions 3.1.8 through 3.1.69 Description The MaatwebsiteExcelFilesDisk::copy function in src/Files/Disk.php resolves the $destination variable, provided via Excel::store, $export-store, or storeExcel, against the process working...
CLSA-2026-1777596493 TuxCare security update for league/flysystem (1 CVE)
TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.1.10-p1+tuxcare...
CLSA-2026-1777596494 TuxCare security update for league/flysystem (1 CVE)
TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.0.70-p1+tuxcare...
PT-2026-74662
TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.0.70-p1+tuxcare...
PT-2026-74661
TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.1.10-p1+tuxcare...
CVE-2026-57856
Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...
CVE-2026-57856: Improper Limitation of a Pathname to a Restricted Directory
Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...
EUVD-2021-2574
Malware in sbrugna...
EUVD-2021-1300
Malware in sbrugna...
EUVD-2022-6920
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2021-32708
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specif...
